What is WinDbg <unknown> Memory?

Question

I'm debugging a Winforms application for a memory leak. In the dump file provided by the customer there is a large discrepancy between the unknown memory usage and the .NET Heap size. (Approximately 1000mb vs 200mb). So what is in the unknown segment other than the VirtualAllocs done by the CLR?

!eeheap -gc output

!address -summary output

Answer 1

Memory that is reported as <unknown> by WinDbg is memory that was allocated via VirtualAlloc(). Some commonly known sources are:

• .NET (because it has its own heap manager)
• direct VirtualAlloc() calls in your code
• C++ HeapAlloc() calls that are larger than some limit (512k if I recall correctly)
• MSXML
• Bitmaps (according to @Hans Passant's comment)